Use-After-Free Vulnerability in Valkey Database
CVE-2026-56684
7.5HIGH
What is CVE-2026-56684?
A use-after-free vulnerability exists in Valkey, a distributed key-value database, due to improper handling of iterator data within the tlsProcessPendingData function. An authenticated client can exploit this flaw to trigger a CLIENT KILL operation, potentially causing the application to crash or allowing for remote code execution in environments where TLS is enabled. This vulnerability is mitigated in Valkey versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Affected Version(s)
valkey < 7.2.14 < 7.2.14
valkey >= 8.0.0, < 8.0.10 < 8.0.0, 8.0.10
valkey >= 8.1.0, < 8.1.9 < 8.1.0, 8.1.9